Closed Bug 715056 Opened 9 years ago Closed 9 years ago

"ASSERTION: wrong node" and crash [@ nsIRange::UnregisterCommonAncestor]

Categories

(Core :: DOM: Selection, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla12

People

(Reporter: jruderman, Assigned: mats)

Details

(Keywords: assertion, crash, testcase, Whiteboard: [inbound])

Attachments

(4 files)

Closing the testcase triggers:

###!!! ASSERTION: wrong node: 'aNode->IsCommonAncestorForRangeInSelection()', file /builds/slave/m-cen-osx64-dbg/build/content/base/src/nsRange.cpp, line 429

Crash [@ nsIRange::UnregisterCommonAncestor]
Attached file stack trace
The text nodes we're normalizing are children of the document, so we're falsely
triggering aNotInsertedYet==true in nsRange::CharacterDataChanged:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#556
because I should have used GetNodeParent(), not GetParent().  Bah!

Try results pending:
https://tbpl.mozilla.org/?tree=Try&rev=5b0e7f840554
Assignee: nobody → matspal
OS: Mac OS X → All
Hardware: x86_64 → All
Attached patch fixSplinter Review
Attachment #585853 - Flags: review?(bugs)
Attached patch crashtestSplinter Review
Attachment #585853 - Flags: review?(bugs) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/cddeb9fcc249
https://hg.mozilla.org/integration/mozilla-inbound/rev/db09603b4186
Flags: in-testsuite+
Keywords: crash
Whiteboard: [inbound]
Target Milestone: --- → mozilla12
You need to log in before you can comment on or make changes to this bug.